GDPR
We meet GDPR requirements through our own privacy program and declare our compliance.
| Topic | Details |
|---|---|
| Scope of application | We apply data minimization to all personal data we process, wherever the person lives. |
| Legal basis | When we process data on your behalf, the Data Processing Agreement applies. |
| Data residency | ThingsBoard Cloud runs in two independent regions, North America and the EU, and data never moves between them. Private Cloud runs in North America, the EU or APAC. Cloud and Private Cloud. |
| International transfers | Our DPA includes standard-contractual-clause terms for transfers outside the EU (DPA §11). |
| Sub-processors | Every vendor that may access personal data is listed on our Sub-processors page; we notify customers of material changes. |
| Security of processing | Our information security management system is certified to ISO/IEC 27001:2022. |
| Data subject requests | We handle requests to access, correct or delete data under a documented procedure. Write to security@thingsboard.io. |
| Breach notification | Breaches go through our incident process. We notify affected parties and regulators as the law and our contracts require. |
Read next
Can’t find what you need?
Our security team answers questions, shares documents under NDA and handles vulnerability reports.
-
Contact our security team
Questions, questionnaires and data requests.
-
Get documents
Certificates and policies; request the NDA ones from the library.
-
Report a vulnerability
Tell us privately. We reply within three business days.